POLITECNICO DI TORINO Master’s Degree in Aerospace Engineering

Master’s Degree Thesis Analysis of an Aeronautical Database and Correlation with Single Pilot Operations

Supervisors Candidate

Prof. Giorgio GUGLIERI Luigi RUSSO S266152 Dr. Beatrice CONTI

Dr. Teodor ROCI

Academic Year 2020/2021 Abstract

The aim of the present master thesis is to conduct an analysis of the prob- lem of Runaway Incursions as a compromising element for the introduction of Single Pilot Operations (SiPO), also posing a major threat to flight safety around the world, especially in small airports. All the topics are going to be contextualized in the modern COVID-19 situation. Most of the data used for statistical purposes have been provided by ENAC through the eE-MOR database. Single Pilot Operations and Reduced Crew Operations are considered, by emphasizing the advantages and disadvantages and by describing the opposite reasons towards or against SiPO. Different solutions that might be applied in the following years in order to mitigate risks and increase safety are also going to be shown. Finally, the thesis analyses as a case study a relevant aviation incident in Italy, the 2001 Milano Linate Airport disaster, which caused the death of 118 people. The causes of this accident are described, with big emphasis on how the disaster could have been avoided and possible countermeasures. i Acknowledgements

A Paolo, Margherita e Gennaro, colonne portanti della mia vita. A Paola per aver condiviso con me gioie e difficoltà di questo percorso. A parenti e amici che sono stati al mio fianco in questi anni. Grazie.

ii

Table of Contents

List of Tables vi

List of Figures vii

Acronyms xi

1 Introduction 1

2 Towards Single Pilot Operations 4 2.1 State of art...... 4 2.1.1 CRM Crew Resource Management...... 4 2.1.2 MCC Multi Crew Coordination...... 5 2.2 Pilot Incapacitation...... 7 2.3 Future trend...... 11 2.3.1 Extended Minimum Crew Operations...... 12 2.3.2 Single Pilot Operations...... 12 2.3.3 Against SiPOs...... 26

3 Runway incursions 31 3.1 Introduction to Runway Incursions...... 31 3.1.1 Detailed causes of RI...... 32 3.2 Runway Incursions classification...... 35 3.2.1 Accident & Incident Severity Definition...... 36 3.2.2 Accident & Incident Frequency Definition...... 37 3.3 ENAC Database Analysis...... 37 3.4 Defending against Runway Incursions...... 41

4 Milano Linate disaster 50 4.1 Milano Linate airport description...... 50 iv 4.2 Event description...... 53 4.2.1 The impact...... 53 4.3 Causes...... 54

Conclusions and further research 56

A ICAO ATC communications 57

Bibliography 59

v List of Tables

3.1 Severity classification for Runway Incursions...... 35 3.2 Severity classification...... 36 3.3 Frequency classification...... 37

vi List of Figures

1.1 Traffic trend in Europe (EUROCONTROL)...... 1 1.2 Techniques to improve resilience...... 2

2.1 SHELL (source: Skybrary)...... 5 2.2 Division of the cockpit crew according MCC...... 6 2.3 MCC structure...... 7 2.4 Total number of Pilot Incapacitations from year 2014 to 2020 (source: ENAC)...... 9 2.5 Consequences after a pilot incapacitation...... 10 2.6 Computer based Helios 522 Scenario...... 10 2.7 Transportation comparison in 2016 (source: JACDEC). Deaths by billion kilometers travelled in Europe...... 11 2.8 Crew costs vs Number of seats (source: Aviation Daily)... 14 2.9 Conventional vs. single-pilot operations (source: [7])..... 14 2.10 Taxonomy for SiPO (source: [7])...... 15 2.11 Capt - Nominal conditions...... 17 2.12 FO - Nominal conditions...... 17 2.13 Pilots - Off-Nominal conditions...... 17 2.14 Likert-Type Rating Scale for Safety Effect (source: [7])... 18 2.15 Perceived Safety of RCO compared to Dual Crew...... 19 2.16 Perceived Safety of SiPO compared to Two- Crew...... 19 2.17 Perceived Acceptability of SiPO compared to Two- Crew.. 19 2.18 Airline Operations Center (source: [7])...... 22 2.19 Examples of ground operator unit structures (source: [7]).. 24 2.20 Automation vs Number of ground operators (source: [7]).. 25 2.21 Differences between AIs (source: [11])...... 27 2.22 Costs for airlines (ALPA) (source: [11])...... 28 vii 2.23 Public opinion on where the government should prioritize investments (source: Ipsos)...... 29 2.24 Percent of those polled who replied to the question “Would you fly on a pilotless plane if the airfare was 10, 20, 30% cheaper?” (source: Ipsos)...... 29 2.25 Public opinion on the best defense against emergency in flight. (source: Ipsos)...... 29

3.1 Where is the hold position line? (source: [14])...... 33 3.2 Example of a closed runway (source: [14])...... 33 3.3 Example of an intersection (source: [14])...... 33 3.4 RWY Incursions - Different scenarios...... 34 3.5 Number of reports for RI caused by Aircrafts from 2015-2020 (ENAC)...... 38 3.6 Number of reports for RI caused by Persons from 2015-2020 (ENAC)...... 38 3.7 Number of reports for RI caused by Vehicles from 2015-2020 (ENAC)...... 38 3.8 ENAC Database on RWY incursions reporting...... 39 3.9 Number of events vs year. Note the exponential trend.... 41 3.10 Number of movements vs year. Note the linear trend..... 41 3.11 Number of events vs year (included 2020)...... 41 3.12 Number of movements vs year (included 2020)...... 41 3.13 Lights and associated meaning. (source: [24])...... 44 3.14 RI defence architecture source: [13]. The primary input to the system is provided by sensors and traffic information services and is input from Air Traffic Controller (ATCO) and pilots via a Human Machine Interface(HMI). From this information, the system assesses the traffic situation and provides warnings or alerts to pilots and ATCOs via air field lighting signals or HMIs...... 46 3.15 SMAAS - source: [22]...... 47 3.16 Visualisation of Traffic, FMS-selected RWY and assigned taxi route.source:[22]...... 48 3.17 Integrated representation of closed runways and taxiways. source:[22]...... 48

4.1 Milano Linate airport description (ICAO)...... 51 viii 4.2 West Apron - AIP Italy (not in scale)...... 52 4.3 R5-R6 Branching in West Apron...... 52 4.4 Conditions of some signs in Linate - Original old picture by ANSV...... 55

ix

Acronyms

ACARS Aircraft Communication Addressing and Reporting System AGI Artificial general intelligence AIP Aeronautical Information Publication ALPA Air Line Pilot Association ANSP Air Navigation Service Provider ARIWS Autonomous Runway Incursion Warning Systems

CAT Commercial Air Transport CRM Crew Resource Management

EASA European Aviation Safety Agency eE-MOR electronic ENAC - Mandatory Occurrence Reporting xi eMCO Extended Minimum Crew Operations

ENAC Ente Nazionale per l’Aviazione Civile

ESARRs EUROCONTROL Safety Regulatory Requirements

EUROCONTROL European Organisation for the Safety of Air Navigation

FAA Federal Aviation Administration

FDR Flight Data Record

HGO Hybrid Ground Operator

MCC Multi Crew Coordination

PF Pilot Flying

PNF Pilot Non Flying

RI Runway Incursions

RST Runway Safety Team xii RVR Runway visual range RWSL Wunway Status Lights

SA Situation Awareness SMAAS Surface Movement Awareness and Alerting System SiPO Single Pilot Operations

TWY Taxiway

xiii Chapter 1 Introduction

COVID-19 pandemic has deeply affected the aviation industry. The restric- tions on travel imposed by governments, together with the lack of confidence among travellers has forced many companies to cancel flights all around the world. According to the EUROCONTROL, which is the European organization in charge of guaranteeing a safe and seamless air traffic management in Europe, we have witnessed a huge decrease in air traffic going from about -90% in April to the -55% in September [1]. This drop resulted in more than 5 million fewer flights with catastrophic consequences on the aviation market.

Figure 1.1: Traffic trend in Europe (EUROCONTROL)

The aforementioned organization forecasts that if the states will remain uncoordinated in their response to cross-border air travel, and the passenger 1 Introduction demand remains extremely low as a result of COVID-19 uncertainty, there will, in Europe, potentially be a total loss of revenues for airlines, airports and ANSPs of approximately €140 billion during 2020. The COVID pandemic has not only affected this field from a financial point of view, but poses new challenges that the aviation industry has to overcome in order to restart the air travels system. The latter is indeed highly interconnected, sophisticated and merges people and technology. This means that the consequences of shut-down and restart are not completely predictable. Thus the resilience of the aviation system needs to be improved. Organisations will need to prepare good strategies for communications and decision making, using expertise, information and good internal and external coordination. A possible strategy is shown in 1.2.

Figure 1.2: Techniques to improve resilience

In order to identify safety issues affecting commercial aviation during and after the return to service, EASA (European Aviation Safety Agency) has developed the COVID-19 safety risk portfolio. This document has been drawn up with the contribution of different stakeholders that have expressed their safety concerns. These concerns were then reviewed by EASA, which has created a list of 48 safety issues. Each of them has a title and at least one associated fact sheet, which is intended 2 Introduction to provide information on the applicable key risk areas (potential accident outcomes) and aviation domains. The document contains different safety issues that are divided as follows:

1. Management Systems – safety issues related to management systems and the integration of CV19 mitigations into organisations’ work. 2. Human Performance – the impact of the shutdown and return to service on human performance, such as fatigue or wellbeing. 3. Outdated Information – the shutdown means that several types of information may be out of date and difficult to update in time for a return to service, or to maintain updated with reduced staff. 4. Training, Checking and Recency – the safety issues relating to training, checking and recency were sufficiently numerous to form their own category. 5. Infrastructure and Equipment – safety issues relating to maintain- ing or returning infrastructure and equipment to service, such as fuel contamination, ground service equipment serviceability, damage to aero- drome surfaces caused by parked aircraft. 6. Financial Impact – the financial impact of the shutdown and gradual return to service has some effects on safety such as fewer resources and disconnected supply chains.

Throughout the next chapter, a particular emphasis will be given to the following topics: How will COVID 19 afflict the trend towards the SiPO (Single Pilot Operations) and the possible future implementations of SiPOs.

3 Chapter 2 Towards Single Pilot Operations

2.1 State of art

The current standard for civil/cargo aviation is using at least 2 qualified pilots (Multi Crew Operations). This is required in order to ensure the safest possible operations and has been regulated by a branch known as Crew Resource Management (CRM). This discipline was created after the Tenerife airport disaster, where a PAN AM Boeing 747 collided on the runaway with the KLM Boeing 747, leading to the death of 583 people. As a consequence of this accident, it urged the necessity of improving aviation safety.

2.1.1 CRM Crew Resource Management

As stated in the ICAO NCAA document on Crew Resource Management [2], the term CRM: "[...] refers to the effective use of all available resources: human resources, hardware, and information to achieve safe and efficient operation" The CRM uses a simple tool, called SHELL to understand the interactions of multiple components (Software/Hardware/Environment and Lifeware) and human performance aspects, hence increasing the synergy between pilots, the redundancy, the cooperation and allowing a reduced workload on pilots. 4 Towards Single Pilot Operations

Figure 2.1: SHELL (source: Skybrary)

The letters in the word SHELL of Figure 2.1 have the following meaning:

• S = Software ;

• H = Hardware ;

• E = Environment ;

• L = Lifeware .

As already mentioned, CRM studies the interactions between the four letters and the central letter, and so:

• Software-Lifeware ;

• Hardware-Lifeware ;

• Environment-Lifeware ;

• Lifeware-Lifeware .

The Lifeware-Lifeware is regulated by the MCC.

2.1.2 MCC Multi Crew Coordination In accordance with AMC GM FCL 1 pilot students have to successfully complete the course Multi Crew Coordination MCC, which is a part of the CRM.

1Acceptable Means of Compliance and Guidance Material to Part: Flight Crew Licensing 5 Towards Single Pilot Operations

MCC has the task of ensure and simplify the cooperation of different characters in the 2-man cockpit and, to achieve so, it establishes a clear division of roles of each component of the crew. The tasks of the two pilots are therefore divided according to the control of the aircraft and the status, as shown in 2.2. Based on controlling the aircraft there is a division between Pilot Flying (PF) and Pilot Non Flying (PNF). The first one (PF) has the the objective of flying the aircraft, while the other one focuses on supporting the PF, on communication, setting the NAV-AIDS 2 and on the observation of the surrounding airspace. Both pilots check the physical conditions of the other. On the other hand the division according to the status is made between Pilot in Command (PIC) and First Officer (FO). In particular, the PIC is generally the pilot with the most experience and has to coordinate the operations, to set priorities and to make final decisions in critical situations after a joint meeting. On the other hand, the FO has to provide the partner with information, accept delegated tasks and cooperatively cross-monitor the status of the aircraft.

Figure 2.2: Division of the cockpit crew according MCC

Moreover, the MCC rules the exchange of communication in the cockpit as shown in Figure 2.3:

• Call Outs • Announcements • Command

2Navigation Aids 6 Towards Single Pilot Operations

• Order

• Checklists & Briefing

Figure 2.3: MCC structure

This division is needed to synchronize actions and distribute responsibili- ties, allowing the two pilots to share the same level of knowledge of the flight conditions and to raise awareness during critical situations. All the com- munications exchanged between the two pilots have to be clear, structured and unambiguous in order to avoid misunderstandings and to improve the cooperation. Furthermore, MCC defines the use checklists that are actions that pilots have to read and perform in a specific order to avoid inattentions despite their experience. In addition to this, the MCC defines the surveillance actions. PF and PNF must observe the flight progress, the aircraft system and airspace. Moreover they must observe a continued cross monitoring toward the other pilot and have to adopt a specific behaviour in case of pilot incapacitation.

2.2 Pilot Incapacitation

Pilot Incapacitation is the term used to describe the inability of a pilot, who is part of the operating crew, to carry out their normal duties because of the onset, during flight, of the effects of physiological factors. 7 Towards Single Pilot Operations

In order to keep track and collect all the warnings and both aeronautical mandatory events and voluntary events, ENAC has developed since 2014 the eE-MOR 3 system. According to the ENAC database, in the period June 2014 - March 2020 the number of pilot incapacitation warnings in Italy reported by pilots or ANSP using the eE-MOR system is 27. It is important to emphasise the fact that the quantity of data the system has collect is scarce and therefore limited to perform a statistical analysis. Even though, from the following picture (Figure 2.4) it appears that the number of pilot incapacitation has increased with time (exception for the 2016 and 2020), a real trend cannot be identified. In fact, the eE-MOR system was introduced only permanently in 2015, and at least a couple of years were necessary to get the pilots and associations used to this service. Consequently the increasing number of events must be seen not particularly as an increment of pilot incapacitations events, but as an increase of warnings by the responsible authorities. The data collected in 2020 are not statistically significant given the Covid situation, and because they do not cover the whole year, but just the early months of this year. It is therefore possible to classify these events based on the consequences they have had. All over this document, events are classified as follows:

1. Moderate Consequences

2. Medium Consequences

3. Catastrophic Consequences

21 out of the total 27 reports are classified as "Moderate Consequences", 6 of them had a "Medium Consequences", and none of them had "Catastrophic Consequences". An example of Moderate Consequences is the pilot having a malaise, however after a check he is able to depart, the only consequence is a delay on scheduled time of departure or arrival at the planned destination. On the other hand, with the term "Medium Consequences" the consequence could be an emergency landing or landing in a different airport with respect

3electronic ENAC - Mandatory Occurrence Reporting 8 Towards Single Pilot Operations

Figure 2.4: Total number of Pilot Incapacitations from year 2014 to 2020 (source: ENAC) to the one originally scheduled. In addition to this, rescheduling a flight (in another day) is part of this category. With the term "Catastrophic Consequences" it is possible to identify all incidents where the loss of capacity by one or more pilots has led to the death of at least one passenger or the partial/full loss of the aircraft. Although in the period under review there were no fatal incidents, it is worth remembering the event Helios Airways Flight 522, where leak in the pressurization system led to the incapacitation of the two pilots, causing 121 deaths. See Figure 2.6. As previous anticipated, the previous analysis is limited to the Italian flights in a relatively short range of time. Further analysis were conducted by [3]. In this research article the authors Evans and S-A.Radcliffe seek to determine the annual incapacitation rate of the UK commercial pilot population, taking into account events that occur off duty as well as during flight duty periods. They have quantified the airline pilot incapacitation rate of 0.045 and impairment rate of 0.013 per 100,000 flying hours ([4], [3]). 9 Towards Single Pilot Operations

Figure 2.5: Consequences after a pilot incapacitation

Figure 2.6: Computer based Helios 522 Scenario

10 Towards Single Pilot Operations

2.3 Future trend

The use of the aforementioned standards as described in section 2.1, together with the significant advances in weather monitoring, automation, navigation, surveillance, communications, and information-processing technologies during the last decades, have made the aviation world one of the safest way of transportation. This is also confirmed by a research conducted by JACDEC 4, as it can bee seen in Figure 2.7.

Figure 2.7: Transportation comparison in 2016 (source: JACDEC). Deaths by billion kilometers travelled in Europe

Despite this fact, EASA has identified for the next year the need for a transition towards Extended Minimum Crew Operations(eMCO) and Single Pilot Operations (SiPO). This transition is expected to be done in two steps. Industry expected timeline foresees eMCO by 2025 and SiPO by 2030.

It is important to underline that aviation has already seen a reduction of crew in the past. In the 1950s, commercial aircraft typically had a cockpit made of 5 crew members classified as follows: captain, first officer, flight engineer, navigator, and radio operator. Advances in voice communication in the 1970s equipment removed the need for a dedicated radio operator. After that, advances in navigation equipment (e.g., inertial navigation systems) removed the need for a dedicated navigator position. Lastly, advances in monitoring equipment for engines and aircraft systems removed the need for a dedicated flight engineer position.

It is also remarkable how the the functions associated with the radio operator, navigator and flight engineer positions did not simply disappear, but instead they are now performed by the captain and/or first officer, that

4Jet Airliner Crash Data Evaluation Centre 11 Towards Single Pilot Operations are constantly assisted by cockpit equipment, which is able to deeply reduce the human workload originally required to perform those functions. However, a transition towards eEMCO and SiPO is far more complicated compared with the transition we have witness in the past. Crucial aspects have to be taken into account to guarantee safe and continuous operations, especially against pilot incapacitation, which will be further discussed in this dissertation. Furthermore, is to be reminded that single pilot operations are today already allowed for gliders, Very Light Jets for business aviation, aerial surveillance, Agricultural operations, ...) as described by [5]. However, this field will not be covered in along this discussion, instead high emphasis will be put on commercial aviation.

2.3.1 Extended Minimum Crew Operations In eMCO, or also called RCO (Reduced Crew Operations), two human pilots are on-board the aircraft. Two pilots fly, as they normally do today, during high-workload, congested airspace conditions, such as surface operations, departure, initial climb-out, descent, approach, and landing. However, during the cruise phase of flight, only one pilot is actively engaged in flying the aircraft. The other one is resting or possibly napping. It is crucial that the equivalent level of safety is the same as standard operations, this could be achieved through compensations means, like ground assistance, advanced cockpit, incapacitation detection, etc Those are operations in which the flight time is extended by allowing a member of the crew to rest during flight. It is in particular relevant in case of large aeroplanes operated in Com- mercial Air Transport (CAT), for which no less than 2 flight crew members are currently required as per the regulation on Air Operations.

2.3.2 Single Pilot Operations As stated in [6], EASA refers to the term SiPO as Single Pilot Operations. In SiPO, the only pilot on-board the aircraft serves as the captain and pilot- in-command (PIC), making all decisions and performing actions pertaining to command of the flight. In the event that assistance is needed, a ground operator may be linked to the cockpit via digital data-link, video, and/or radio. 12 Towards Single Pilot Operations

The transition towards Single Pilots Operations is explained by EASA in their Agenda Item n°16. In this document the cite the following reasons why a transition towards eMCOs and SiPOs is needed and possible:

• Industry is seeking further reduction of pilots in the cockpit based on technological advancements ;

• Need in the operational world to increase flight duty time without “re-inforcing” the Flight Crew ;

• Need to cope with foreseen pilot shortage ;

• More recent cockpit design and automation potentially allowing reduc- tion of workload compatible with “phase of flight limited” single pilot operations.

As reported by [7], the costs associated with crews (salaries, benefits, training, etc.) are a big portion of the aircraft operating cost. Moreover those costs are higher especially for regional/commuter operators that typically fly smaller aircraft with fewer seats rather than major airline operators. This concept is expressed in Figure 2.8. Moreover, [7] states that the current modern operations are performed by two person, namely the captain and the first officer. They are both supported by the aircraft avionic equipment and are constantly monitored by a dispatcher (ATC controller). On the other hand, a different approach should be used for SiPo. The first officer is not needed anymore in the configuration. All his/her actions must be safely performed by either integrated air/ground tools or by a ground controller. It is to be noted the change of roles of the dispatchers: from a controlling and monitoring subject, they become active part of the scheme. They might be called to support the captain during more demanding flight phases (departure, approaching, checklists...). In Figure 2.9 this concept is shown. 13 Towards Single Pilot Operations

Figure 2.8: Crew costs vs Number of seats (source: Aviation Daily)

14 Figure 2.9: Conventional vs. single-pilot operations (source: [7]) Towards Single Pilot Operations

The functions of the ground operator are to be defined based on the the pilot condition and the flight condition. Therefore, a basic taxonomy is defined in Figure 2.10:

Figure 2.10: Taxonomy for SiPO (source: [7])

In the Figure 2.10 four different scenarios that might happen during a normal mission are presented:

Nr 1 Is the situation where both the pilot condition and the flight condition are nominal. The use of the ground operator in this situation might be unnecessary while the cockpit automation could provide assistance to the captain during non demanding flight phases.

Nr 2 In this situation the pilot is acting normally, while the flight condition could be Off-Nominal (engine fire, cabin depressurization, or diversion to an alternate airport due to low fuel and/or bad weather, etc.) or require high workload. Therefore, the captain might seek some assistance from the ground operator to share the high workload.

Nr 3 The pilot is incapacitated and the flight conditions are nominal. Being the pilot incapacitated, the ground operator has to assume the role of captain and interact with the cockpit in order to safely land the aircraft, which means remote manipulation of the aircraft’s flight management system (FMS), or remote manipulation of the aircraft’s mode control panel (MCP) for sending speed/altitude/heading commands to the autopilot. 15 Towards Single Pilot Operations

Nr 4 In this situation both the captain is incapacitated and the flight condition is Off-Nominal. In this circumstances the ground operator could be not able to land the aircraft alone and might seek assistance from other ground operators.

Based on previous considerations is it clear that in order to implement SiPOs in the near future some critical issues must be avoided or reduced. In this dissertation three issues are going to be analyzed: how to reduce the workload on the pilot, how to improve the avionics, and how ground operator unit must be organized.

Pilot’s workload during SiPOs In 2017 NASA published the results of a a pilot-in-the-loop high fidelity motion simulation study in partnership with the Federal Aviation Adminis- tration (FAA) [8]. The study was conducted on thirty-six pilots (18 crews), representing 5 major US airlines and its attempt was to quantify the pilot’s contribution to flight safety during normal flight and in reponse to aircraft system failures. More in details, they have tested each crew in conventional operations (two- crew), reduced operations (eEMCO) and single pilot operations, simulating also nominal and off-nominal conditions, then they have tried to understand the mistakes made by pilots, the causes for this mistakes and they have also analyzed the workload on both the pilot and the first officer. According to Bailey et al., the number of mistakes is higher in SiPOs rather than in conventional operations. Based on the experiment observations, this propensity for flight crew errors was directly related to pilot workload. Moreover they have also found out that: • Checklist usage is more consistent and accurate in two-crew vs. RCO or SiPO operations. In RCO, the start of the checklist was often delayed until the resting pilot came back to flying duties. On the other hand, in SiPOs the start of the checklist was often delayed until the resting pilot came back to flying duties. • Flight path performance was better in two-crew than SiPO or RCO In order to present the results, NASA has used the NASA Task Load Index (TLX). This scale goes from 0 to 100, and takes account of six subscales of workload: mental, physical, temporal demand, performance, effort, and 16 Towards Single Pilot Operations frustration. The tests results are shown in the following pictures. (Figure 2.11, 2.12, 2.13). The box plot data in the previous pictures show the mean value by the red line, the 25th and 75th percentile by the extent of the box, with the 5% statistical spread from the mean shown by the indent. The whiskers show the maximum and minimum values up to 1.5x the interquartile range. Plus signs indicate ratings outside of 1.5 x interquartile range.

Figure 2.11: Capt - Nominal condi- Figure 2.12: FO - Nominal conditions tions

Figure 2.13: Pilots - Off-Nominal con- ditions

Interestingly, it is possible to observe from Figure 2.11 that the workload for the CPs is reduced in the RCO configuration compared to the two-crew configuration during nominal flight conditions. These data are anomalous as there are two effects in play. First, RCO means that the Captain had a resting period. Crews noted that the RCO concept, where one of the pilots is resting in the cockpit (napping), can be an effective fatigue mitigation. Secondly, 17 Towards Single Pilot Operations the experiment design artificially introduced higher workload ratings for the nominal two-crew condition. The nominal two-crew was run as the first event for the subjects and this run was not repeated. In hindsight, the experiment should have used the first run as familiarity and thrown the data away. In the first run, the subjects naturally have some anxiety, being in a new environment and being subjects in a research experiment. As such, their self-assessed workload skewed high. Workload for the Captain in the SiPO condition trends much higher than the RCO condition, but not tremendously. The same workload anomaly for the two-crew configuration for the CPs is reflected in the FOs as well. (Figure 2.12). The two-crew workload is anomalously high. In the case of the RCO condition, the low workload is due to a nominal flight condition - so the FO did not have much to do. The trend for higher workload by the FO during SiPO is likely due to a CP’s greater experience and familiarity with being responsible for the entire operation. Further, by experiment design, they put the FO in the left seat; thus, increasing their workload to acclimate to a different seat not generally used by FO. In the presence of non-normals as in Figure 2.13, the workload data from the CP and FO became almost identical, therefore only one graph is pre- sented. The data show a statistically significant increase in workload for the SiPO condition compared to the nominal two-crew and RCO configurations. The data also reflects the wide disparity of non-normals tested, from the relatively easy to handle hydraulic leak to the rudder trim runaway and dual generator failures which significantly increase physical and temporal workload, respectively. Moreover, post-test data was used to gather a perspective view from the flight crew of safety and acceptance for RCO and SiPO: The safety of the flight for the RCO and SiPO crew complement was evaluated in comparison to current-day two-crew operations using the color-coded, thirteen point Likert-type scale as shown in the following picture (Figure 2.14):

Figure 2.14: Likert-Type Rating Scale for Safety Effect (source: [7])

The scale ranges from “no safety effect” to “catastrophic” safety effects 18 Towards Single Pilot Operations for RCO and SiPO. The pilots also used a seven-point Likert-type scale to rate the “acceptability” of RCO and SiPO compared to two-crew operations, with a rating of 1 being “completely acceptable” and a rating of 7 being “completely unacceptable.” The results are shown below in Figure 2.15, 2.16, 2.17:

Figure 2.15: Perceived Safety of RCO Figure 2.16: Perceived Safety of SiPO compared to Dual Crew compared to Two- Crew

Figure 2.17: Perceived Acceptability of SiPO compared to Two- Crew

The SiPO condition was clearly not well appreciated by the flight crew (perceived safety shown in Figure 2.16 and acceptability in Figure 2.17). Remarkable quotes from the pilots are: "single pilot can be conducted safely except certain non-normal operations could become very risky" but the majority of the ratings reflect the opinion that SiPO is “dangerous; no one to share workload or responsibilities.” Or also: "As the system stands it would 19 Towards Single Pilot Operations be catastrophic – would require vast changes to A/C and ATC system – perhaps impossible – no human safety net – reduces safety and increases risks – environment demands two person effort." In conclusion it is clear, that at this moment Single Pilot Operations are generally not appreciated by pilots. This is due to the temporary increase of the workload, but also to the lack of a supervision. Therefore, some solutions to reduce the problems previously highlighter must be taken in the following years. In particular in order to allow safe SiPO all the functions currently performed by the First Officer can be handled using either an aircraft- centric approach, an air-ground approach, or a by combination of the two. In the following chapters both solutions will be analyzed separately, even though it is expected that "a combination of the two is going to be necessary in order to provide a robust system" as stated by [9].

Aircraft-centric approach

This approach attempts to solve the problem primarily by the addition of automation to the flight deck along with new procedures and training for the single pilot. According to [7]: "some simple tasks like reading checklists and conducting cross-checks, are good candidates for automation, although such systems will have to possess some of the same characteristics as the operator they are replacing." The next challenge is to make the automation a team player, rather than a machine only executing operations. However, this requires changes in the way the automation interacts with the human, rather than what tasks it performs. For example, cockpit automation needs to clearly inform the captain about what it is doing, and to confirm important parameters. When a command from the captain is received, the automation must repeat it for error-checking, inform the captain that it is executing the command, and notify the captain when it is done. Moreover, it is important to remember that both the pilots and the automation are called to cooperate and collaborate. Assigning more tasks to the automation could lead the captain to lose awareness and to be excluded from the "Human Loop" as found out by [10]. Therefore, both the captain and the automation have to be able to delegate tasks between each other in a simple yet quick, reliable, and well understood way. Another function that automation could perform and that is going to 20 Towards Single Pilot Operations be crucial in RCO/SiPO technology is the monitoring of the captain’s physiological and behavioral state. This could be done in order to asses the capacity of the captain and to catch possible mistakes. The detection of potential issues could warn the ground base that could safely remote pilot the aircraft in order to avoid disasters. The physiological state could be obtained trough sensors that can assess health factors ranging from simple heart rate variability and pulse oxygen levels to more elaborate measures such as electro-encephalograms (EEG) and functional near-infrared spectroscopy (fNIRS). Behavioral measures are also important. Monitoring the captain’s ac- tions is critically important to detect piloting errors and to make assessments of cognitive capability. One common way of understanding the behavioral state is by using prescriptive assessments, where the human’s behavior is compared to what he/she should be doing at any particular time or after performing a particular task. Although they are useful, they could be not flexible for real- time operations. Another approach could be the detection of the behavioral state by the ground operators. They can query the captain or watch a video of the cockpit to determine the physiological and behavioral state. Based on their evaluation they can declare the captain incapacitated and transfer the control of the aircraft to ground operators/cockpit automation. Not only it is critical to identify the pilot incapacitation, but also to detect automation failure, and/or communications failure. If the automation is malfunctioning (e.g. stuck in a mode, erroneous flight data, software bug) or non-functional (e.g., total failure of autopilot, guidance, secondary systems), the captain and ground operators must be able to safely land the aircraft and perhaps safely complete the mission.

Air-Ground Approach

From the previous discussion, it appears clear that in SiPOs the support from a ground station is needed, especially during complex situations like the ones described in Figure 2.10. The ground assistance could be part-time or scheduled, meaning that the operator could be called during high workload phases (take off, approaching, landing...). Moreover, in order for this solution to be cost effective, it is advised that a single ground operator has to monitor more than one flight at the same time. Should the ground operator need further help, a dedicated assistance could be the solution. In the following 21 Towards Single Pilot Operations chapters the current ground based configuration and more suitable for SiPOs are going to be presented, showing the advantages and disadvantages of each configuration. Furthermore, the lack of initial Situation Awareness (SA) for the ground assistant in dedicated assistance will be discussed and analysed.

Figure 2.18: Airline Operations Center (source: [7])

In the previous (2.18) the modern positions in the AOC centers are represented. Each position is supervised by the Operations Manager. It has already been discussed that in the future only the position of the dispatcher is going to change, the other positions are going to be the same. Nowadays, each dispatcher serves around 20 aircraft in various flight phases and has different duties based on the aircraft status. Generally each dispatcher helps the aircraft from the pre-flight planning to gate arrival. In each flight phases they have a different functions, for example, in the pre- flight phase the dispatcher (together with the captain) is in charge of making a flight plan, determine fuel loading, meet weight and balance requirements, and ensure compliance with the minimum equipment list (MEL). In addition to this, the dispatcher provides support to the cockpit crew during off- nominal conditions such as aircraft equipment malfunctions, diversions to a different destination airport, and large changes in routing. In future SiPOs, dispatchers become ground operators, they are called to provide support, but they have also piloting abilities. According to [7] the ground operator teams will have to perform the following three functions:

1. Conventional Dispatch of multiple aircraft ; 22 Towards Single Pilot Operations

2. Distributed Piloting support of multiple nominal aircraft ;

3. Dedicated Piloting support of a single off-nominal aircraft.

Whereas the conventional functions have already been discussed, it is important to focus the attention especially on the Distributed Piloting functions and Dedicated Piloting support. The Distributed Piloting is the function associated to the Taxonomy Condition 1, as described in Figure 2.10. The functions are non-urgent and therefore one ground operator can provide help to multiple aircraft. The functions can spread from reading a checklist, conducting cross-checks to the diagnosing an aircraft system caution light, determining the fuel consequences of a holding instruction. The Dedicated Piloting function could be necessary in the other 3 conditions (2,3,4) of the Taxonomy 2.10. This function might be requested by the captain during high-workload or challenging off-nominal operating conditions such as an engine fire, cabin depressurization, or diversion to an alternate airport due to low fuel and/or bad weather, etc. This function applies if the captain of the aircraft becomes incapacitated. There are several tasks associated with this function, for example the ground operator might be called to fly the aircraft, and as a consequence to manipulate the Flight Management System for route amendments, or the Aircraft Mode Control Panel (MCP) for the speed, altitude and heading commands to the autopilot. In order to perform the latter functions, the ground operators will require some instruments on the ground that are the same as the ones in the flight deck. Moreover, the instruments must communicate in real time (or with a reasonable delay) and the air-ground voice and data link signal must be encrypted in order to guarantee safe operations. Even though having safe operations is important, another crucial aspect to be taken into account are the costs. One price factor is the number of ground operators relative to the number of aircraft they can safely support, as well as the training/qualification requirements for those ground operators. Then, the number of ground stations requires complex and reliable equipment, such as remote controls an aircraft’s flight-path. After conducting several tests in "human-in-the-loop" evaluation [10], NASA has identified two different ground operator structures: an hybrid ground operator unit and a specialist one. Both of them are presented in Figure 2.19 and will be described hereafter. 23 Towards Single Pilot Operations

Figure 2.19: Examples of ground operator unit structures (source: [7])

Hybrid Ground Operator Unit In this organizational unit, the ground operators are defined as Hybrid Ground Operator (HGO). Each of them is trained and certified in order to carry out all three functions described earlier (Conventional Dispatch, Distributed Piloting and Dedicated Piloting support tasks). Each HGO generally assists multiple flights from pre-flight planning to gate arrival. However, in case of off-nominal condition the issue could be transferred to a dedicated support. The HGO could then provide one-on- one support to the offnominal aircraft. After the off-nominal situation is satisfactorily resolved, the aircraft previously handed off by this HGO are returned to him/her if they have not already landed.

Specialist Ground Operator Unit In this organizational unit, there are two types of members that perform only certain tasks:

• Ground Associates (GAs) : they are trained and certified to perform Conventional Dispatch and Distributed Piloting support for nominal 24 Towards Single Pilot Operations

aircraft. They are in charge of monitoring nominal aircrafts. • Ground Pilot (GPs) : they are trained and certified to perform Dedicated Piloting tasks for off-nominal aircraft. Generally the GPs will be less in number compared to the GAs. In case the condition of an aircraft become off-nominal, then the situation is going to be handled by a GP, that would provide one to one support to the off-nominal aircraft and when the emergency situation is over the control will be switched again to GA.

In conclusion it must be said that there is a close connection between the number of operators on the ground and the level of on-board automation, as it can be seen in the next figure (2.20).

Figure 2.20: Automation vs Number of ground operators (source: [7])

In general, the higher the level of automation reached, the less will be the number of ground operators. This is true because the on board computer will assist the captain without the intervention of the ground operator. In Figure 2.20, the green oval represents the suitable domain for human- automation function allocations for SiPO. Moreover, it is possible to identify the cost of the operations, which depends not only on the number and qualifications of the operators but also on the level of automation reached. For this reason, the cost of conventional operations is proportional to the distance of the blue dot from the origin of the axes. A,B,C in the previous picture (Figure 2.20) are three situations suitable for SiPOs: 25 Towards Single Pilot Operations

The first situation is indicated in the picture with the letter A. This is the situation where each first official is replaced by an equivalent ground operator. Even though this scenario is favourable to SiPOs, it would be unimaginable to apply because it would not be cost effective. The second situation, letter B, it is the opposite of the situation A. In particular, in B, no first officer is replaced by any human ground operator. Although this solution might be ideal, the costs associated to its implemen- tation would be too high to be applicable, hence they would produce an economic loss compared to the two crew operations. A compromise between A and B is C. This requires a smaller number of ground operators compared to A, and also a minor level of automation compared to B. The costs associated with C are significantly smaller compared to the others.

2.3.3 Against SiPOs

SiPOs is a controversial topic. Although many have brought out the potential benefits of this potential future implementation. Many others , such as the Air Line Pilot Association (ALPA) [11], have taken different positions. ALPA’s president Joe DePete states: "[...]No computer or pilot in a remote setting can match an onboard pilot’s dedication to making each flight better than the last" According to [11] there are far more disadvantages rather than advantages in SiPOs. In particular they claim that there are safety and economic concerns. Moreover, the lack of a second pilot in the cockpit will not only dramatically increase the workload of the captain, but also will also erase a critical layer of monitoring and operating redundancy in the cockpit, thus reducing safety. As a matter of fact, as seen in Figure 2.2, ENAC’s data have shown that, in case of pilot incapacitation, more than often the presence of a second pilot was necessary to overcome the emergency. It seems clear that in the future the inability of the captain in the SiPOs poses a concrete risk and the solutions seen before have to be carefully implemented in order to avoid any kind of risk. The future technology will need to be able to replicate the sensing, assessing, reacting, adapting, and interacting capabilities of a human in a complex and dynamic environment; however at the moment the modern technology is only able to perform limited tasks. As stated in [11]: "This level of automation is decades away from becoming reality" 26 Towards Single Pilot Operations

A solution offered by ALPA is AGI 5, which is the hypothetical intelligence of a machine that has the capacity to understand or learn any intellectual task that a human being can. AGIs could be able to effectively replicate human judgment across a broad spectrum of sensing, analytical, decision-making, and implementation functions (Figure 2.21). In the future this capability might safely replicate the redundancy in the cockpit offered by the 2 pilot cockpit. However, according to ALPA, this technology is still a theoretical construct and experts say that AGIs are at least two decades away.

Figure 2.21: Differences between AIs (source: [11])

Another technological issue highlighted in the same document is the cy- bersecurity threat in the cockpit. In order to safely implement reduced-crew or single-pilot operations it might be necessary to encrypt the air-ground signal to avoid hacker attacks or jamming of the signal. However, encryption introduces signal delays (order of seconds) which can be unacceptable during emergency situations. Moreover, countries have different laws governing the use of encryption technology, and some have banned it altogether. Further- more it is not so uncommon to lose communication with the aircraft from the ground. This could be catastrophic in single pilot operations, especially if the pilot become incapacitated. In the document it is stated that economic savings are not worth if compared with the safety risks and challenges associated with single-pilot operations. In particular it is know that the costs associated with salaries and crews

5Artificial General Intelligence 27 Towards Single Pilot Operations is just the 5 % (Figure 2.22) of the total expenses of an airline company and the reduction of costs could be jeopardized if compared with those associated with the implementation of this technology, such as: outfitting or retrofitting aircraft with the necessary automation, sensors, communications systems, but also ground infrastructure costs; salaries and benefits for remote ground-based pilots and certification costs.

Figure 2.22: Costs for airlines (ALPA) (source: [11])

One last aspect to take into account is the will of people that possibly are going to take advantage of SiPOs. According to a research conducted by Ipsos in the USA, people are not really convinced that SiPOs should happen. In particular the results published by Ipsos show that the interviewed think that the implementation of SiPOs is not of crucial importance. The USA government should not invest towards the reduction of crew members, but public opinion is more oriented towards the improvement of ATC control, fuel efficiency and speed. (2.23). When asked the question: "Would you fly on a pilotless plane if the airfare was 10, 20, 30 % cheaper?", the interviewed have replied as shown in Figure 2.24: As it can be seen from the previous picture, there is a common fear of single pilot operations. Even though the price of the tickets would be 10% discounted, 77% of the people would still not take it. Even if it was 30%, around 1/4 of the interview would take it. Furthermore, according to this research, 80% of the interviewed think that the best defense against urgent problems occurring during flight is by having two pilots working together. Only 8% think that single pilot operations would be effective against in-flight problems. 28 Towards Single Pilot Operations

Figure 2.23: Public opinion on where the government should prioritize investments (source: Ipsos).

Figure 2.24: Percent of those polled who replied to the question “Would you fly on a pilotless plane if the airfare was 10, 20, 30% cheaper?” (source: Ipsos)

29

Figure 2.25: Public opinion on the best defense against emergency in flight. (source: Ipsos) Towards Single Pilot Operations

In conclusion, Single Pilot Operations represent the future of civil aviation. The researches that are going to be conducted in the following years are going to be decisive in order to convince both the investors and the public opinion that it is possible to guarantee the same level of safety as the current standard. This must be achieved trough innovative, safe, yet low-cost solutions.

30 Chapter 3 Runway incursions

The purpose of this chapter is to understand what a Runway Incursion (RI) is, how are they classified by ICAO and possible strategies against them. Moreover,in Chapter4 the Linate Airport disaster (2001), which is the most remarkable accident due to an incursion in Italy, is going to be discussed as a case study.

3.1 Introduction to Runway Incursions

According to the definition provided by ICAO in Doc 4444 - PANS-ATM [12], Runway Incursions are:

"Any occurrence at an aerodrome involving the incorrect presence of an aircraft, vehicle or person on the protected area of a surface designated for the landing and take off of aircraft".

Different Scenarios for Runway Incursions

It is possible to divide Runway Incursions according to who/what causes the event. The conventional division described by Schönefeld and Möller [13] is:

• ATCO-induced situation → In this scenario the runway incursion is caused by the controller who is not able to ensure sufficient separation between two landing or departing aircraft. An example could be the authorization from the ATC to an aircraft to land on a runway that is already in use. 31 Runway incursions

• Pilot Deviations → In this scenario the runway incursion is caused by the pilot who does not successfully fulfill the directions given by the regulations. An example in this category could be the aircraft that crosses a taxiway hold line, entering a runway for which the aircraft has not been authorized by an air traffic controller. This situation could happen especially when the pilot loses the positional awareness. More in detail, when the pilots land an unfamiliar airport the flight crew becomes disorientated as they exit the runway. • Vehicle/pedestrian deviations → This scenario is caused by pedestri- ans,vehicles,or other objects that interfere with aircraft operations by movements that have not been authorized by air traffic control(ATC) and or APRON controllers. An example could be provided: vehicle driver is not sufficiently familiar with the maneuvering area layout at an airport and misinterprets the runway entry clearance issued by ATC which causes him to enter the runway at the incorrect position.

3.1.1 Detailed causes of RI In this section all the causes of Runway incursions with examples are pre- sented. According to [14] this is necessary in order to have a complete idea of the phenomenon and understand how to prevent it. The main causes of runway incursions presented in the aforementioned document are:

• Weather → Extreme weather conditions, such as snow, ice, sunset, ... could cause many low visibility problems which could cause troubles not only for pilots, but for the Air traffic controller as well, that could be unable to detect the position of the aircraft, unless provided with a ground radar. Figure 3.1 is in this sense explanatory. It clarifies how difficult it is to identify correctly the hold position line in low visibility conditions. • Aerodrome design → There are several airport factors that might affect pilot situational awareness and distract the crew, such as the closed runways, confusing intersections, too many vehicles or a non-ICAO- conformal lights, signs. An example of closed runway and dangerous intersections are provided in Fig. 3.2 and Fig.3.3. Generally speaking, the most incidents occur on hot spots, which are defined by ICAO as: "A location on an aerodrome movement area with 32 Runway incursions

Figure 3.1: Where is the hold position line? (source: [14])

Figure 3.2: Example of a closed runway Figure 3.3: (source: [14]) Example of an in- tersection (source: [14])

a history or potential risk of collision or runway incursions and where heightened attention by pilots/drivers is necessary". [15]. In order to avoid incidents at hot spots, ICAO requires that pilots must ask crossing clearance to cross holding positions. It has been found [16] that when aircrafts have to cross active runways to move between their take off or landing runway and their parking position, the likelihood of runway incursions increases. In addition to this, another critical aspect might be the use of Simultaneous Use of Intersecting Runways. This could lead to loss of separation, thus increasing the level of risk.

Possible scenarios of current incursions are shown in Figure 3.4. 33 Runway incursions

Figure 3.4: RWY Incursions - Different scenarios

• Phraseology → the use of non-Standard Phraseology or non-adherence to Standard Phraseology can lead to clearance confusion and misunder- standing between flight crew and controllers.

Although ICAO requires pilots to be proficient in English, the phraseol- ogy could also be easily misunderstood by non native English speakers;

• Workload → It is possible to distinguish between

1. Pilot Workload: When pilots land in a new airport, flight crew have to orientate themselves quickly in respect of their actual position in relation to taxiways and the airport layout. After clearing the runway, they also have to reconfigure aircraft systems in accordance with the After Landing Checks and may receive detailed taxi instructions from ATC. Similar levels of workload may occur prior to departure while the flight crew are concurrently carrying out tasks including configuring the aircraft systems ready for take-off, briefing crew and passengers, receiving amended departure clearance instructions from ATC, checking unfamiliar departure procedures, etc. Under these circumstances of high workload, a temporary loss of situational awareness or communications confusion are more likely to occur. 34 Runway incursions

2. Controller Workload: Controllers handling multiple aircraft move- ments and handovers have relatively little time available for monitor- ing individual aircraft to confirm that they are taxiing in accordance with their clearances. The situation is even worse at local airports, where small aircraft are allowed to talk in the local language, rather than in English. As a consequence of this, the workload for the con- troller could be higher, such as the likelihood of misunderstanding.

• Distraction: Pilots or controllers might be disturbed by the presence of particular objects/people/events around them.

3.2 Runway Incursions classification

In the document [15], ICAO defines a classification scheme for runway incursions, as shown in Table 3.1. This definition of a taxonomy for RI is based on ICAO’s events severity and frequency classification as detailed in Tables 3.2 and 3.2, and which is further discussed in EUROCONTROL Safety Regulatory Requirements (ESARRs) Attachment A [17].

Table 3.1 Severity classification for Runway Incursions Severity Description A serious incident in which a collision is narrowly A avoided. An incident in which separation decreases and there is significant potential for collision, which may result B in a time-critical corrective/evasive response to avoid a collision. An incident characterized by ample tme and/or dis- C tance to avoid a collision An incident that meets the definition of runway incursion such as the incorrect presence of a single D vehicle, person or aircraft on the protected area of a surface designated for the landing and take-off of aircraft but with no immediate safety consequences. Insufficient information or inconclusive or conflicting E evidence precludes a severity assessment

35 Runway incursions

3.2.1 Accident & Incident Severity Definition

This distinction is needed in order to keep track of the severity of each event. It is possible to choose between the following categories: accident, serious incident, major incident, significant incident, no effect and risk not determined, as detailed in Table 3.2

Table 3.2 Severity classification Severity Classification "An occurrence associated with the operation of an aircraft which takes place between the time any person boards the aircraft with the intention of flight Accident until such time as such persons have disembarked, in which: A person is fatally or seriously injured; The aircraft sustains damage or structural failure; The aircraft is missing or is completely inaccessible." [18] "An incident involving circumstances indicating that Serious incident an accident nearly occurred" [18] An incident associated with the operation of an aircraft, in which safety of aircraft may have been compromised, having led to a near and collision Major incident between aircraft, with ground or obstacles (example: safety margins not respected which is not the result of an ATC instruction). An incident involving circumstances indicating that an accident, a serious or major incident could have Significant occurred, if the risk had not been managed within incident safety margins, or if another aircraft had been in the vicinity. No safety effect An incident which has no safety significance Insufficient information was available to determine Not determined the risk involved or inconclusive or conflicting evi- dence precluded such determination.

36 Runway incursions

3.2.2 Accident & Incident Frequency Definition Another distinction is also possible based on the frequency a RI is happening. According to ICAO, it is possible to distinguish among five qualitative frequency categories, defined in Table 3.3.

Table 3.3 Frequency classification Frequency Classification Has never occurred yet throughout the total lifetime Extremely rare of the system Only very few similar incidents on record when con- Rare sidering a large traffic volume or no records on a small traffic volume Several similar occurrences on record - has occurred Occasional more than once at the same location A significant number of similar occurrences already Frequent on record has occurred a significant number of times at the same location A very high number of similar occurrences already Very Frequent on record - has occurred a very high number of times at the same location

3.3 ENAC Database Analysis

According to the database provided by ENAC on Runway incursions between 2015 and 2019, the total number of warnings reported using the eE-MOR system has been in total 646, and the total number of movements has been of 8200486, thus the rateo of reporting is 0.787758189 per 10000 movements. This value is calculated as an average value taking into account the 5 years of analysis. A more extensive explanation of why the database is limited to only 5 years can be found in Section 2.2, and moreover a more detailed scenario could be seen in Figure 3.8. ENAC database classifies runway incursions according to the cause of the accident. As already described in previous chapters (3.1), conventionally a 37 Runway incursions runway incursion can be caused by another aircraft, by a vehicle/equipment or by persons. According to the reports provided by ENAC, incursions are caused mainly by other aircraft (425 between 2015-2020) and are followed by the one caused by vehicles (135 between 2015-2020). The less frequent are the ones caused by persons that have been recorded to be only 39 in the 5 years period into analysis. More detailed information, including the total number of reports and the ratio for each year, can be found in Fig. 3.5, 3.6, 3.7.

Figure 3.5: Number of reports for RI caused by Aircrafts from 2015-2020 (ENAC).

Figure 3.6: Number of reports for RI caused by Persons from 2015-2020 (ENAC).

Figure 3.7: Number of reports for RI caused by Vehicles from 2015-2020 (ENAC).

38 Runway incursions

Real incidents observed by ENAC and that happened in Italy are going to be presented above, with the aim to better explain the reader each category. • Runway incursions by an Aircraft. Real events recorded by ENAC are especially the pass of the vehicle over the stop bar without being authorized by the ATC and with the consequent activation of anti intrusion sensors. Many of this reports have no operative consequences. • Runway incursions by an Vehicle/Equipment. Examples of this category are mainly represented by the presence of unauthorized vehicles on runways. • Runway incursions by a Person. To this category belong incursions that are caused by unauthorized people on the runway. Generally, this person could be part of the maintenance team (mowing, electricians or inspections team), but could also be passengers.

Figure 3.8: ENAC Database on RWY incursions reporting

Fig 3.8 is particularly interesting. Not only it shows the significant boost of the air transportation in Italy between 2015-2019, but it also shows an increasing trend in the number of reports. This could be linked to two main reasons: at first, it has been shown that there is a correspondence between the quantity of movements and the number of reports [19]. Moreover, the eE-MOR database is a relatively new system and it required time for the users to get used to this new procedure and report correctly. When the users get experienced with the new system, it is reasonable to suppose that also the number of reports increases. Moreover, when the total number of events for each year in Fig. 3.5, 3.6, 3.7 are summed up, a discrepancy with 3.8 can 39 Runway incursions be found. This is due to the fact that a distinction in three event type is only theoretical, but often it is not possible to link an incident to a single category. Therefore, an event could be labelled in two categories or appear multiple times in the total number of runway incursions reported in Fig. 3.8. According to [19], the relations between traffic increase and runway incur- sions is not 1:1, but exponential: "The U.S. Federal Aviation Administration began tracking runway incur- sion in 1988 and their statistics clearly show that there is an exponential relationship between traffic increase and increase in runway incursions. From 1988 to 1990, traffic grew by 4.76 percent and runway incursion rates grew by 43 percent. The following years, from 1990 to 1993, there was a decreasing in traffic by 5.34 percent and runway incursions were down 30 percent." When analyzing the relatively fragmented ENAC’s database (incomplete data in early years), such a trend could not be identified for all the five years in analysis. For example during 2015-2016 there was an increase in traffic of +5.2%, on the other hand the number of events reported decreased of 10%. However, some periods reflect the exponential trend very well. For example, during the years 2016-2017 the air traffic in Italy increased of +1.74%. In the same period the number of reports increased from 72 to 127, showing a +76.4% growth. This number reflects what has been already told previously: after almost two years from its implementation, users were more used to the eE-MOR system, and this rise could be explained. The exponential growth could be perfectly seen in the two years period 2017-2018, where traffic increased of +4.18% and the number of reports of +41.7%. Fig.3.9 and 3.10 show the linear and exponential increase for respectively the number of movements and the accident due to runway incursions in the period 2015-2019 in analysis. Moreover, the previously discussed trends cannot be identified if we include also the data available for the year 2020. This year has been very unique for civil aviation, that never experienced such a crisis. In this year the total number of movement in Italy has decreased from 1655381 in 2019 to 708602 in 2020, with a decrease of -57.1%. Fig. 3.11 and 3.12 represent the number of events and the number of movements in Italy and include also the year 2020. It possible to notice that not only the number of flights in Italy decreased, but also the number of runway incursions significantly decreased from 187 in 2019 to 86 in 2020 (-54%). 40 Runway incursions

Figure 3.9: Number of events vs year. Figure 3.10: Number of movements vs Note the exponential trend. year. Note the linear trend.

Figure 3.11: Number of events vs year Figure 3.12: Number of movements vs (included 2020). year (included 2020).

3.4 Defending against Runway Incursions

In the last decades, also in view of the worldwide growth in air traffic, runway incursions have become the greatest threat to aviation safety at aerodromes.[13] In 2013, ANSV has observed a significant increase (+40%) in Italy of reporting concerning runway incursions with respect to the previous year. [20]. In recent years, accidents like the MD-87 in Milano Linate Airport accident and a growing number of runway incursion incidents, including several near- misses, have led to the initiation of various Runway Safety initiatives and researches all around the world, focusing both on-ground and on-board solutions, in order to reduce the number of incursions. According to [21], the first way of defence against Runway Incursions is by assuring adequate communication skills during ground operations. 41 Runway incursions

Communications and different work procedures are indeed potential sources of misunderstanding. By heavy standardization of communications where every word should be by the book, runway incursions can be reduced by making sure everyone understand what permission they have. It is therefore essential that pilots always when communicating with air traffic control services use only standard phraseology ICAO to communicate briefly and concisely to ensure that properly understand all instructions from air traffic controllers to literally repeat all instructions on the runway. The standard communication must be used for ATC-Pilot communications as well as for communication with the ground-personnel or ground vehicles. Examples of standard communications are reported in AppendixA According to Vernaleken et al. [22] and Schönefeld and Möller [23] the main cause of runway incursions is linked with the lack of situational awareness which is generally due to adverse weather conditions and the nonconformance of airport lights, signs or markings to ICAO regulations. Therefore one strategy against runway incursions is by increasing the situational awareness and pro-active conflict detection with respect to ownship position, the location of relevant other traffic, potential operational restrictions and clearances assigned by ATC. At the present state, the situation awareness of traffic on surrounding taxiways and traffic in the runway environment is essential to avoid potential mistakes. Currently, the pilots use a combination of visual acquisition and ATC clearances in order to have a mental model of the surrounding area. However, this is significantly more difficult when visibility deteriorates. For this reason, one recently introduced improvement is the ADS-B and TIS-B, that have the potential of showing high resolution, integral and accurate surface traffic data even in the worst weather conditions. Moreover, another critical situation that emerges from the current situation is that the maps of the airport contain only quasi-static airport information and are updated every 28 days with the AIRAC cycle. However, short term informations or temporary changes, such as closed runways, are not indicated, leading to a series of disaster and catastrophic consequences. One way that a pilot can be informed on short-term and temporary changes is through the Pre-Flight Information Bullettin (PIB). This document is often longer than 30 A4 pages and the pilots have to bear the burden to create a mental picture of the airport by locating and combining PIB with aerodrome mapping informations. Therefore, it is clear that new on board measures for pilots as well as 42 Runway incursions ground measures for ATC are necessary to increase the flight crew’s situational awareness.

Ground Measures According to [19] and [24], one first strategy against runway incursions is by building physical barriers protecting the perimeter of the runway and aerodrome operating theatre. In this way, a significant portion of unauthorized people as well as land-based wildlife can be kept away from the runway. Moreover, other important factors in the safe operation of aerodromes are the numerous lighting, signs, runway markings etc. When a single sign is misplaced or malfunctioning the likelihood an incursion can happen is increased. Therefore it is evident that the maintenance system of aerodromes is an important preventive measure. For examples, stop bars are installed at Runway Holding Positions and provide protection at runways and reduce the risk of runway incursions by increasing the visibility of Runway Holding Positions, reducing the risk of ATC clearance being misinterpreted and by enhancing safety during low visibility conditions. The use of lights to prevent runway incursions is widely spread and described in ICAO Annex 14 [25], regarding the aereodrome design and operations. Although ICAO Annex 14, Volume 1 provides for the use of certain types of lighting to protect the runway, no specific priority or meaning is attached to these lights. A proposal of meaning associated to those lights can be seen in Figure 3.13 Light colours and their proposed meaning are here reported:

• RED lights ahead of an aircraft or vehicle mean: it is unsafe to proceed beyond the RED lights. This is the case regardless of whether the lights are fixed, alternating or flashing and is independent of an ATC clearance.RED means STOP!

• YELLOW lights are used to convey a similar but less distinct message. They indicate that a potential hazard exists beyond the lights, but that in conjunction with an appropriate ATC clearance it will be safe to proceed.

• GREEN lights are often used to indicate the route to be followed by an aircraft or vehicle, particularly at night or in periods of reduced visibility. In all cases green lights are a routing aid and must only be followed in conjunction with an ATC clearance. 43 Runway incursions

Figure 3.13: Lights and associated meaning. (source: [24])

In addition to standardized color codes for lights, ICAO has also adviced in the future to use Autonomous Runway Incursion Warning Systems (ARIWS). An example of this system could be the use of Runway Status Lights (RWSL). Those lights are autonomous and are developed to deliver automatic warnings and runway status indications to pilots and manoeuvring area vehicle drivers. The operation of an ARIWS is based upon a surveillance system which monitors the actual situation on a runway and automatically returns this in- formation to warning lights at the runway (take-off) thresholds and entrances.

Another developed technology is the "Follow The Greens". In this tech- nology each aircraft is linked with a segment of lights on the runway. By moving forward the aircraft pushes this segment ahead. The green lights autonomously guide pilots to the correct point by turning to green colors when the pilot should move, and turning red when the aircraft must not move (example: stop bars). This system can work in all visibility conditions and automatically provides safe separations. With this technology the number of communications with ATC is significantly reduced, thus increasing safety and reliability. Another key topic identified by the [19] is the presence of a Ground radar, which is extremely important for the safe continuation of operations in an aerodrome. The latter is used to identify, in all weather conditions, people, 44 Runway incursions objects, vehicles and planes that are on the runway without permission. In general, possible solutions to mitigate incursions could be the estab- lishment of aerodrome local Runway Safety Team (RST), as identified by [24]. The role of this team would be of maintaining runway safety across all parties creating an aerodrome level safety management function. More in detail the role of the aerodrome local Runway Safety Team should be to advise the appropriate Management on the potential runway safety issues and to recommend mitigating measures and solutions for those identified issues. Specific objectives of an aerodrome local Runway Safety Team include development of appropriate runway incursion risk prevention measures and creation of awareness of potential solutions, advising Management on runway safety issues and recommending mitigation measures. As already seen in section 3.3, a big portion of runway incursion incidents is caused by ground vehicles. Therefore, the European Plan for Runway Incursions [24] has identified a formal training, assessment, proficiency check and authorisation programme for all drivers operating airside. This training aims to teach the air side driver about the national and aerodrome regulations, as well as the personal responsibilities they have (no smoking, general driving standards, responsibilities to ensure the vehicle is suitable for the task and used correctly, no cellphones). In addition to this, the training aims also to teach the communications to be used, the speed limits in the aerodrome, emergency procedures that have to be taken in case of fire, of emergency, vehicle accident,... The runway incursions are especially critical in complex airports, in degraded visibility conditions (with airport markings obscured by snow, fog, ...), or at airports in which the flight crew is not familiar with. In all this conditions potential serious incidents and accidents could happen. Above all of them, the Tenerife accident in 1977 is considered the worst-ever accident in civil aviation caused by a runway incursion. In this occasion two Boeing B747 collided on the runway and this led to the death of 583 people.

On board Measures

Runway incursion prevention technology is based on protecting measures against causes that lead to a runway incursion and providing alerts during the cause of a runway incursion. To achieve this runway incursion protection requires removing the human from the loop as much as possible [13] The general architecture of a runway incursion prevention system is shown 45 Runway incursions in Figure 3.14.

Figure 3.14: RI defence architecture source: [13]. The primary input to the system is provided by sensors and traffic information services and is input from Air Traffic Controller (ATCO) and pilots via a Human Machine Interface(HMI). From this information, the system assesses the traffic situation and provides warnings or alerts to pilots and ATCOs via air field lighting signals or HMIs.

The previous (Figure 3.14) show the primary input to the system is given by information from various sensors and from traffic information service networks. Such information are generally fused by multi sensor data fusion, that integrate background information (maps and movement models into tracks describing the movements at the airport). This description is valuated, and ATC commands such as route instructions are integrated to assess the traffic situation, to predict conflicts and to detect runway incursions. Information about the traffic situation is given to ATC, pilots and vehicles via a human machine interface (HMI) (e.g. to pilots trough an Electronic Flight Bag (EFB), and signals at the airport or via radio telephony (RTF) are from an Air Traffic Controller (ATCO)). The fact that the architecture communication of the distributed components belongs to the technology is important because a communication infrastructure to support high speed data transfers from/to sensors and signals distributed across the airport is not always available. For example, the operation of intelligent signals on serial circuits requires the use of power line communication technology with sophisticated algorithms to ensure real-time constraint compliance. One possible solution presented in [22] is through the use of the Surface Movement Awareness and Alerting System (SMAAS). The SMAAS is made of two complementary parts, as shown in Figure 3.15. The first part is aimed at maximizing crew situational awareness in various 46 Runway incursions

Figure 3.15: SMAAS - source: [22] domains (OAF-CAF-CDTI presented later). The second part is dedicated to safety-net alerting SMA (Surface Movement Alerting). The core element of the SMAAS encompasses an airport moving map based on an DO-272A/ED 99A compliant Aerodrome Mapping Database (AMDB), which is intended to provide the crew with enhanced positional awareness to avoid disorientation on the airfield. The basic airport moving map can be enhanced by three further situational awareness functions respectively indicated as

• OAF – Operational Awareness Function. This function processes and presents relevant information on the operational configuration of the airport, such as runways in use, or runway/taxiway closures;

• CAF – Clearance Awareness Function. This function increases the crew’s awareness of clearances assigned by ATC, by presenting the assigned taxi route;

• CDTI – Cockpit Display of Traffic Information. Allow to see the traffic on the ground and during takeoff or landing phases in relation to the airport moving map in order to increase the traffic awareness. 47 Runway incursions

tr Figure 3.17: Integrated representa- Figure 3.16: Visualisation of Traffic, tion of closed runways and taxiways. FMS-selected RWY and assigned taxi source:[22] route.source:[22]

If this display fails to prevent a hazardous situation, the second part (SMA Surface Movement Alerting subsystem) comes into play. The afore mentioned subsystem is itself divided in two integral parts: a preventive and a reactive one. The primary goal of preventive alerting is to ensure that ownship does not cause a runway incursion. To achieve this, the alerting part is armed using the same airport, operational and clearance data as the awareness part of the SMAAS. This enables specific alerting tailored to the particular operational situation, which is by itself a prerequisite for preventive alerts up to warning level (level 3). Preventive alerting encompasses situations such as entering a runway that is completely closed due to heavy construction, or attempting to take off from a partially closed runway, or any runway other than the one set in the FMS flight plan. In parallel to this ownship surveillance, relevant surrounding traffic is continuously monitored, particularly while ownship is in the takeoff run or on final approach. In the runway environment, traffic alerting is rule-based, i.e the underlying algorithm essentially determines whether an ownship or intruder manoeuvre requires exclusive runway usage. Thus, the system is capable of detecting situations in which a purely kinematic approach fails. The system was tested using the Research Flight Simulator of TUD’s Institute of Flight Systems and Automatic Control and the results 48 Runway incursions have shown that SMAAS is a possible effective solution against runway incursions since it supplies pilots with operationally relevant and desirable information at different levels, ranging from the mere display of information to warning/level 3 alerts.

49 Chapter 4 Milano Linate disaster

In the following chapter the Milano Linate disaster will be described using the information provided by the official ANSV report.[26]. It happened on the 8th October 2001 at 6.10 UTC and involved the MD-87 from Scandinavian Airline with radio identification code SK686 and the private jet Cessna 525-A, with code D-IEVX. The MD-87 was on duty and it was transporting 104 from Milano Linate to Copenhagen. On board there were also 2 pilots and 4 flight attendants. The private jet had two pilots and had to carry two entrepreneurs from Milan to Paris La Bourget. The MD-87 during its take-off, hit at about 270 km/h the taxiing Cessna. After the impact, the MD-87 lost the right engine, and attempted to take off. However, it clashed with an airport building intended for baggage handling. All the people on board, together with 4 person in the building died because of the accident. It is recalled and considered as the worst aviation incident in Italy, leading to the death of a total of 118 people. The catastrophe is a clear example of how dangerous runway incursions are. The events, causes and consequences are going to be subsequently described.

4.1 Milano Linate airport description

In this section the Linate airport at the moment of the disaster is going to be described. The airport is located 4.32 miles Southeast from Milan and has the following geographical coordinates: 45°27’01”N and 09°16’46”E. The medium elevation of the airport is 353 ft AMSL. The airport structure could be seen in Figure 4.1. The airport is provided with two separate runways, 50 Milano Linate disaster called 18L/36R and 18R/36L (only used by General Aviation). The airport, according to the AIP (Aeronautical Information Publication) charts of the time, had also two aprons used as parking slots for aircraft, respectively called North apron and West apron. A detailed view of the the west apron could be seen in Figure 4.2.

Figure 4.1: Milano Linate airport description (ICAO)

Parallel to the runway 18L/36R there was a taxiing lane that started from the north apron and it was connected with the main runway 18L/36R using 4 different Taxiways (TWY) called R1, R2, R3, R4. The west apron in the following figure has instead two different TWY called R5, leading to the north apron, and R6 leading to south-east. At the time of the incident, a branching line leading towards the R5 and R6 was painted on the ground, as shown in Figure 4.3. A further investigation after the accident will reveal that those signs were not in compliance in shape, size and color with the Annex 14 ICAO prescriptions on Aerodrome standards [25]. Moreover, they were worn out because of the time and tires. In 1996, consequently to an increase of traffic, it was decided to print other signage lines, called S1, S2, S3, S4, S5. The S1-S5 were printed, however a documentation on the correct position and how to use them were not provided. Moreover, they were never made legal and communicated to the 51 Milano Linate disaster

Figure 4.2: West Apron - AIP Italy (not in scale)

AIP.

Figure 4.3: R5-R6 Branching in West Apron

52 Milano Linate disaster

4.2 Event description

According to Figure 4.1 it is possible to identify the following situations:

1 Flight SK686 taxied to the holding point for runway 36R. Heavy fog had delayed the flight by more than one hour. While the visibility was improving, RVR was still only 225 metres. 2 The Cessna Citation parked at the West Apron received the following clearance from the Tower: "DeltaVictorXray taxi North, via Romeo 5, QNH 1013, call me back at the stop bar of the main runway extension" The pilot was instructed to taxi via Romeo 5 (R5), he read the clearance back correctly,but entered taxiway Romeo 6 (R6). 3 The Cessna stopped at an intersection called Sierra 4 (S4). The pilot reported his position and was instructed back to hold and wait for the controller clearance. "DeltaVictorXray, Roger, maintain the stop bar, I’ll call you back" 4 06.09:28 the SK686 was cleared for take off, after the following commu- nication from the TWR: "Scandinavian 686 Linate clear for take off 36, the wind is calm, report rolling, when airborne squawk ident." 5 At 06.06:19, the Cessna received the following communication: "DeltaVic- torXray continue your taxi on the main apron, follow the Alpha Line" 6 The two aircraft collided.

7 The stricken MD-87 skidded off the runway into a baggage hangar adjacent to the passenger terminal.

4.2.1 The impact At 06.10:18, the ACARS system of the MD-87 sent a signal of correct take-off to the Scandinavian airline base in Copenhagen. At 06.10:18 the two aircraft collided. At the moment of the impact the Cessna was crossing the runway with a nose of 135°, whereas the MD-87 was rotating at a normal speed of about 270 km/h on the runway. About one second before the impact the FDR of the MD-87 registered a significant pitch up manoeuvre given by the pilots. 53 Milano Linate disaster

This event is significant because showed the investigators that the Cessna 172 was seen only 1 second before the impact, because of the dense fog that day in Milan. After a careful revision of the sound registered by the black box of the MD- 87, it was found out that the collision happened in three different moments: at first the front landing gear of the MD-87 hit the Cessna’s horizontal stabilizer, then with the left landing gear hit the right wing of the Cessna and in conclusion the right landing gear hit the fuselage of the Cessna and tore apart the small jet. After the impact the MD-87 loses the right engine. Although the pilots gave maximum thrust to the left engine, the aircraft was not able to climb up, because the left engine had sucked many debris and it was not able alone to provide the necessary thrust. The MD-87 climbed only 10 meters and then slept on the runway and hit the luggage building of the aircraft. Because of the dense fog, after the impact no one gave the alarm, and the first alert was sound only 3 minutes after the impact. It has been discovered that many had survived after the impact and died because of the fire. They could have been saved if a more rapid intervention occurred.

4.3 Causes

The description of this event is interesting because it shows how dangerous a runway incursions can be. According to the the ANSV [26], runway incursion at Linate were not rare events. In the period preceding the incident about one runway incursion happened every week. According to the authors of the report, the main causes of the disaster are:

• Low visibility (50-100m); • High traffic; • Non-compliant signage → the signs at the airport at the time were old and did not meet the ICAO Annex 14 standards (R5-R6). Others were completely unknown (S4). Moreover, at some points they were covered by grass and not easily seen, as shown in Figure 4.4. • Lack of ground radar → at the moment of the impact a ground radar in Linate was not installed. However, a new radar system was bought and it was not installed for about 8 months. 54 Milano Linate disaster

• Lack of alarm sensors → the alarm sensors that could have reported that something wrong was happening, were deactivated and thus not working; • Non-compliant ICAO communications → the communication between tower/aircraft were non standard. • Non-trained controllers → the controller was not informed on the Sierra 4 taxiway and was not able to understand the mistake; • Lack of low-visibility standard operations.

co Figure 4.4: Conditions of some signs in Linate - Original old picture by ANSV

55 Milano Linate disaster

Conclusions and further research

To conclude, the aim of this dissertation was to investigate the potential role of Single Pilot Operations and the key role that they could have in the future of aviation, also as a mean to improve the flight conditions for pilots in the COVID-19 crisis. However, our findings suggest that we are currently far from a forthcoming introduction of this new technology. The lack of technology, regulations by the competent authorities and also a bad acceptance by the public suggest that much more has to be done. Future investigations and studies are necessary to validate the kinds of conclusions that can be drawn from this study. In the second part of this thesis, emphasis was given on runway incursions. The aim of this study was to frame those events and see the number of incidents that they cause every year. Although much has been done in the past to improve the situation, runway incursions still pose a threat on security and those events must not be underestimated. In future studies, more research is needed to apply and test the new technologies, both on ground and on board, that will help to mitigate the problem. Throughout the writing of this thesis numbers, assertions and conclusions were always supported by concrete database and facts recorder by the Italian authority for civil aviation (ENAC). However, the secrecy of the recorded data, together with an inconsistent database on certain occasions, have posed an additional obstacle against the development of this thesis. In additions to this, the database in analysis in comparison with other national databases, only record events in a small amount of time. Future research should certainly further test the consistency of this database and could potentially investigate the effects of runway incursions not only on a national base, but also on an European/world level.

56 Appendix A ICAO ATC communications

A: TAXI PROCEDURES ATC: (call sign) TAXI VIA RUNWAY (number); PILOT: (call sign) REQUEST BACKTRACK ATC: (call sign) BACKTRACK APPROVED ATC: (call sign) TAXI TO HOLDING POINT [number] RUNWAY (number); Or where detailed taxi instructions are required: ATC: (call sign) TAXI TO HOLDING POINT [number], RUNWAY (number) HOLD SHORT OF RUNWAY, (number) [contact TWR] ATC: (or CROSS RUNWAY (number)) TIME (time);

B. HOLDING INSTRUCTIONS FROM ATC ATC: (call sign) HOLD (direction) OF (position,runway number, etc.); ATC: (call sign) HOLD POSITION; ATC: (call sign) HOLD (distance) FROM (position) ATC: (call sign) HOLD SHORT OF (position); READBACK FROM PILOTS/DRIVERS PILOT: (call sign) HOLDING; PILOT: (call sign) HOLDING SHORT.

57 ICAO ATC communications

C. TO CROSS A RUNWAY PILOT/DRIVER: (call sign) REQUEST CROSS RUNWAY (num- ber. . . ) ATC: ATC (call sign) CROSS RUNWAY (number) [REPORT VACATED] ATC: (call sign) TAXI TO HOLDING POINT [number] [RUNWAY (number)] VIA (specific route to be followed), [HOLD SHORT OF RUNWAY (number)] or [CROSS RUNWAY (number)]

D. PREPARATION FOR TAKE-OFF -CLEARANCE TO ENTER RUNWAY AND AWAIT TAKE-OFF CLEAR- ANCE.

ATC: (call sign) LINE UP [AND WAIT]; ATC: (call sign) LINE UP RUNWAY (number); ATC: (call sign) LINE UP. BE READY FOR IMMEDIATE DEPAR- TURE;

G. TAKE-OFF CLEARANCE ATC: (call sign) CLEARED FOR TAKE-OFF [REPORT AIR- BORNE]. . . . Applicable for Low Visibility operations; Best Practice to prevent wrong runway selection, or when more than one runway in use, always use the runway designator in the instruction: ATC: (call sign) RUNWAY (number) CLEARED FOR TAKE-OFF When take-off clearance has not been complied with: ATC (call sign) TAKE OFF IMMEDIATELY OR VACATE RUNWAY [(instructions)]; To stop: ATC: (call sign) STOP IMMEDIATELY [(repeat aircraft call sign) STOP IMMEDIATELY] PILOT: (call sign) STOPPING;

58 Bibliography

[1] EUROCONTROL. «EUROCONTROL Draft Traffic Scenarios for Septem- ber 2020 - February 2021». In: (2020). url: https://www.eurocontrol. int/sites/default/files/2020-09/eurocontrol-draft-traffic- scenarios-14092020.pdf (cit. on p.1). [2] ICAO. «Crew Resource Management Training Programme». In: (). url: https://www.icao.int/APAC/RASG/eDocs/Advisory%20Circular% 20 % E2 % 80 % 94 % 20Crew % 20Resource % 20Management % 20Training % 20Programme%20(CRM).doc (cit. on p.4). [3] S. Evans and S-A.Radcliffe. «The Annual Incapacitation Rate of Com- mercial Pilots». In: Aviation, Space, and Environmental Medicine 83.1 (Jan. 2012), 83:42–9 (cit. on p.9). [4] Charles Dejohn, Alex Wolbrink, and Julie Larcher. «In-Flight Medical Incapacitation and Impairment of U.S. Airline Pilots: 1993 to 1998». In: (Oct. 2004), p. 30 (cit. on p.9). [5] Key Dismukes and Barbara Burian. «Single-pilot VLJ operations». In: The Aerospace Professional (Feb. 2009) (cit. on p. 12). [6] EASA. THE EUROPEAN PLAN for AVIATION SAFETY (EPAS 2020-2024). Koln, DE: EASA, 2019 (cit. on p. 12). [7] K.D. Bilimoria W.W Johnson and P. C. Schutte. «Conceptual frame- work for single pilot operations». In: HCI-Aero ’14: Proceedings of the International Conference on Human-Computer Interaction in Aerospace (July 2014) (cit. on pp. 13–15, 18, 20, 22, 24, 25). [8] R. E. Bailey, L. J. Kramer, K. D. Kennedy, C. L. Stephens, and T. J. Etherington. «An assessment of reduced crew and single pilot operations in commercial transport aircraft operations». In: 2017 IEEE/AIAA 36th Digital Avionics Systems Conference (DASC). 2017, pp. 1–15. doi: 10.1109/DASC.2017.8101988 (cit. on p. 16). 59 BIBLIOGRAPHY

[9] Joel Lachter et al. «Toward Single Pilot Operations: Developing a Ground Station». In: Jan. 2014 (cit. on p. 20). [10] Summer Brandt, Joel Lachter, Vernol Battiste, and Walter Johnson. «Pilot Situation Awareness and its Implications for Single Pilot Opera- tions: Analysis of a Human-in-the-Loop Study». In: vol. 3. July 2015. doi: 10.1016/j.promfg.2015.07.846 (cit. on pp. 20, 23). [11] The danger of single pilot operations. White Paper. ALPA, 2019 (cit. on pp. 26–28). [12] ICAO. «Procedures for Air Navigation Services Air Traffic Manage- ment». In: (2016). url: https://ops.group/blog/wp- content/ uploads/2017/03/ICAO- Doc4444- Pans- Atm- 16thEdition- 2016- OPSGROUP.pdf (cit. on p. 31). [13] J. Schönefeld and D.P.F. Möller. «Runway incursion prevention systems: A review of runway incursion avoidance and alerting system approaches». In: Progress in Aerospace Sciences 51 (2012), pp. 31–49. issn: 0376- 0421. doi: https://doi.org/10.1016/j.paerosci.2012.02.002. url: http : / / www . sciencedirect . com / science / article / pii / S0376042112000152 (cit. on pp. 31, 41, 45, 46). [14] Airbus Customer Services. «Flight Operations Support and Line Assis- tance». In: () (cit. on pp. 32, 33). [15] ICAO. «Manual on the Prevention of Runway Incursions». In: Doc9870–AN/463 (2007) (cit. on pp. 33, 35). [16] Skybrary - Hot Spots at Aerodromes. https://www.skybrary.aero/ index.php/Hot_Spots_at_Aerodromes. Accessed: 2021-02-14 (cit. on p. 33). [17] EUROPEAN ORGANISATION FOR THE SAFETY OF AIR NAVI- GATION. «ESARR 2 GUIDANCE TO ATM SAFETY REGULATORS - Severity Classification Scheme for Safety Occurrences in ATM». In: 1 (1999) (cit. on p. 35). [18] ICAO. «Aircraft Accident and Incident Investigation - ANNEX 13». In: (). url: https://www.emsa.europa.eu/retro/Docs/marine_ casualties/annex_13.pdf (cit. on p. 36).

60 BIBLIOGRAPHY

[19] Prof. Dr. Mohammad Shahriari and Mehmet Aydin. «Airport Runway Incursions and Safety». In: Jan. 2019, pp. 272–285. isbn: 978-3-319- 94588-0. doi: 10.1007/978-3-319-94589-7_27 (cit. on pp. 39, 40, 43, 44). [20] ANSV. «Raccomandazioni di sicurezza: Runway Incursion sugli aero- porti italiani». In: (). url: https://ansv.it/wp-content/uploads/ 2020/07/ANSV-runway-incursion-racc-sic-3.pdf (cit. on p. 41). [21] Žaneta Miženková. «PREVENTION OF RUNWAY INCURSION». In: 5th International Scientific Conference of PhD. Students (May 2016) (cit. on p. 41). [22] Christoph Vernaleken, Carole Urvoy, and Uwe Klingauf. «Simulator Evaluation of a Novel Surface Movement Awareness and Alerting System (SMAAS) for Runway Incursion Avoidance». In: The 26th Congress of ICAS and 8th AIAA ATIO. doi: 10.2514/6.2008-8959. eprint: https://arc.aiaa.org/doi/pdf/10.2514/6.2008- 8959. url: https://arc.aiaa.org/doi/abs/10.2514/6.2008-8959 (cit. on pp. 42, 46–48). [23] J Schönefeld and DPF Möller. «Runway incursion prevention systems: A review of runway incursion avoidance and alerting system approaches». In: Progress in Aerospace Sciences 51 (2012), pp. 31–49 (cit. on p. 42). [24] Eurocontrol. «European Action Plan for the Prevention of Runway Incursions (EAPPRI)». In: 1 (2017) (cit. on pp. 43–45). [25] ICAO. «Aerodromes - Volume I - Aerodromes Design and Operations». In: (1999). url: https://cfapp.icao.int/fsix/_Library/Manual% 20Aerodrome%20Stds.pdf (cit. on pp. 43, 51). [26] Agenzia nazionale per la sicurezza del volo. «Relazione d’inchiesta Aeroporto Milano Linate 8 Ottobre 2001». In: A/1/04 (2004) (cit. on pp. 50, 54).

61